EchoLeak CVE-2025-32711: Copilot Zero-Click Chain

EchoLeak is the name researchers gave to CVE-2025-32711, a vulnerability in Microsoft 365 Copilot that Microsoft published on 11 June 2025. Microsoft describes it as "Ai command injection in M365 Copilot" that allows "an unauthorized attacker to disclose information over a network", and its advisory says the issue "has already been fully mitigated by Microsoft" with no action for users. It is worth a teardown because the chain shows how an assistant that reads email and documents can be turned into a data courier by content nobody opened.

This is a teardown of a disclosure that someone else made and the vendor already fixed. PlayCISO did not discover it and has not tested it. Facts are attributed and were checked on 4 November 2026. Chain steps are conceptual: no exploit text, payloads or proof-of-concept.

What the weakness was

Microsoft's CWE for the record is CWE-74, injection into a downstream component. In plain words: Copilot answers questions by retrieving the user's email, files and chats and feeding them to a language model. Retrieval is only supposed to fetch data, but the model cannot reliably tell the user's data from instructions hidden inside it. An outsider who can put text into the mailbox, simply by sending an email, can therefore try to write to the model. That is the pattern the paper calls crossing "LLM trust boundaries".

The attack chain, step by step (conceptual)

This follows the arXiv case study by Pavan Reddy and Aditya Sanjay Gujral, which in turn describes Aim Labs' research. The point is that no single flaw did the damage; four separate defences each had to be defeated.

1. Plant. The attacker sends the victim an ordinary-looking email whose text is written to be read by the model, not by the person. The victim does not need to open it.
2. Get retrieved. Later, when the victim asks Copilot something related, retrieval pulls the planted email into the model's context next to the victim's private data.
3. Slip past the injection classifier. Microsoft uses a classifier called XPIA (cross-prompt-injection attempt) to catch instructions in retrieved content. The paper says the email was phrased to evade it.
4. Slip past link redaction. Copilot strips external links from its answers. The paper says a reference-style Markdown form was not redacted, so the attacker's link survived into the response.
5. Exfiltrate without a click. The paper says the response referenced an image, and the client (for example Outlook or Teams) fetches images automatically.
6. Stay inside the content security policy. The CSP blocks unknown domains, so the paper says a Microsoft Teams asynchronous preview endpoint, which was allowed, acted as a relay to the attacker's server.

The result, in the paper's words, is that "a Microsoft service fetches the stolen data on behalf of Copilot, completing the exfiltration with zero user involvement."

Impact, as reported

• Microsoft: information disclosure over a network by an unauthorized attacker. CNA vector: network, low complexity, no privileges, no user interaction, scope changed, confidentiality High, integrity Low.
• NVD: its own primary vector has scope unchanged, confidentiality High, integrity None, giving 7.5.
• The paper: a remote, unauthenticated attacker could cause Copilot to access internal files and send their contents to an attacker-controlled server, using only an email. Microsoft, it says, stated there was no evidence of in-the-wild exploitation.

The fix, as documented

• Microsoft: mitigated server-side; "There is no action for users of this service to take." No patch, version or configuration change is published, and the MSRC record marks customer action as not required.
• Per the paper: a server-side fix was deployed in May 2025, and Microsoft's changes reportedly added options to restrict Copilot from using external communications in some contexts. It calls this a trade-off, since Copilot may ignore some relevant information.
• Design mitigations the paper proposes (its recommendations, not Microsoft's): prompt partitioning, enhanced input and output filtering, provenance-based access control, strict content security policies, least privilege, defence in depth and continuous adversarial testing.

Timeline

What security teams should check this week

There is nothing to patch for this CVE. The checks are about whether you have built the same pattern yourself. The first is Microsoft's; the rest are PlayCISO suggestions that follow from the chain.

• Record the closure. Note in your register that CVE-2025-32711 is a Microsoft-mitigated cloud CVE with no customer action required, and who confirmed it. Do not leave it open on a patch dashboard.
• List every assistant that reads inbound content. Email, tickets, chat, shared documents, web pages and uploaded files. Each is a way for an outsider to write to the model.
• For each one, ask the three questions the chain depends on: does it see untrusted content, does it see private data in the same context, and can it send anything out (links, images, tool calls, API requests)? If all three are yes, you have the EchoLeak shape.
• Close the output channels. Check whether answers can include external links, auto-loaded images or Markdown that a client fetches on render, and whether your content security policy allows any domain that can relay requests.
• Do not rely on one classifier. The chain defeated a classifier and a redaction filter in turn. Put an independent control at the exit: allowlisted destinations, output sanitising, human approval for outbound actions.
• Cut what the assistant can reach. Review permissions on mailboxes, SharePoint-style libraries and shared drives. An assistant sees what its user sees, so over-shared data is over-exposed.
• Test it. Run planted-document tests against your own assistants in a safe tenant. Rehearse in the RAG poisoning lab and the inter-agent sanitization lab.

Why this one is still worth studying

EchoLeak is a clean example of three common ideas: indirect prompt injection (the attacker never talks to the model directly), a lethal mix of untrusted input, private data and an exit, and a bypass chain in which each control failed on its own. Score your own assistants' exposure with the CVSS calculator; the 9.3 versus 7.5 split here is a good exercise in how scope and integrity change a number. For the wider family of attacks, read AI agent hijacking attacks, and for what an agent can hold once hijacked, the Agent Credential Broker Lab.

FAQ

What is EchoLeak (CVE-2025-32711)?

EchoLeak is the name researchers at Aim Security (Aim Labs) gave to a Microsoft 365 Copilot vulnerability that Microsoft tracks as CVE-2025-32711. Microsoft titles it "M365 Copilot Information Disclosure Vulnerability" and describes it as "Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network."

What is the CVSS score of CVE-2025-32711?

It depends on who you ask, and both numbers are on the NVD record. Microsoft, as the CNA, scores it 9.3 Critical (CVSS 3.1, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N). NVD's own primary score is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The difference is the scope and integrity metrics. Always say which authority a score comes from.

Do I need to patch Microsoft 365 Copilot for EchoLeak?

No. Microsoft's advisory FAQ says: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency." The record marks customer action required as false. The fix was server-side.

Was EchoLeak exploited in the wild?

Microsoft's record for CVE-2025-32711 shows "Exploited: No" and an exploitability assessment of "Exploitation Less Likely". The third-party paper reports that Microsoft stated there was no evidence of in-the-wild exploitation. NVD's record carries no CISA KEV fields, and the CISA SSVC entry on it lists exploitation as "none" (dated 14 June 2025). We found no source reporting real-world victims.

Why is EchoLeak called zero-click?

Per the paper summarising Aim Labs' disclosure, the attacker only has to get a crafted email into the victim's mailbox. The victim does not have to open it or click anything. The harm happens later, when Copilot retrieves that email as context while answering a question the victim asked for an unrelated reason.

How did the EchoLeak attack chain work?

At a conceptual level, as the paper describes it: an email carrying hidden instructions is retrieved by Copilot; the instructions evade Microsoft's cross-prompt-injection classifier (XPIA); a reference-style Markdown link evades link redaction; an image reference in the response is fetched automatically by the client; and a Microsoft Teams preview endpoint that the content security policy allowed is used to relay the request to an attacker's server. Each step defeated one defence. See the chain section above.

When was EchoLeak reported and fixed?

Per the paper, Aim Labs built a working proof of concept and privately reported it to Microsoft in January 2025, Microsoft did initial remediation work in the spring, deployed a server-side fix in May 2025, and the advisory and public research came out on 11 June 2025. Microsoft's record shows a release date of 11 June 2025. We could not read Aim's own timeline because its site blocked our fetch.

Is the paper on arXiv from the people who found EchoLeak?

No. The arXiv paper (2509.10540, submitted 6 September 2025) is by Pavan Reddy and Aditya Sanjay Gujral and is a case study that cites Aim Labs' work. It is useful for the mitigation analysis, but treat chain details as the authors' account of Aim Labs' disclosure.

What should a security team do about EchoLeak-style risk?

The product fix is Microsoft's. What remains is design risk you own. The paper recommends prompt partitioning, stronger input and output filtering, provenance-based access control and strict content security policies, plus least privilege and continuous adversarial testing. Our checklist below turns that into questions for any assistant that reads email or documents.

Sources

• Microsoft Security Response Center: CVE-2025-32711, M365 Copilot Information Disclosure Vulnerability (released 11 June 2025; read through the Security Update Guide API on 4 November 2026)
• NVD record for CVE-2025-32711 (published 11 June 2025; Microsoft CNA score 9.3, NVD score 7.5; CWE-74), read through the NVD CVE API on 4 November 2026
• Reddy and Gujral: EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System (arXiv 2509.10540, 6 September 2025). A third-party case study of the discoverers' work; it is the source for the chain and the timeline above.
• Aim Security (Aim Labs) EchoLeak page, the discoverer's own publication. Our fetch was blocked (HTTP 403), so we did not read it and have not attributed any detail to it directly.

This article is educational guidance for security and engineering leaders, not legal advice or a forensic report. It describes a published, fixed vulnerability at a defensive level.